From eda6525eaef97a354e52dbe2e7f454129325d36b Mon Sep 17 00:00:00 2001
From: Jane Liu <janeliulwq@google.com>
Date: Wed, 7 Jun 2017 11:31:27 -0400
Subject: Fixing FPDFPage_TransformAnnots

Came across this error in FPDFPage_TransformAnnots, where SetNewAt()
would fail on a bound assertion when a newly created array calls it.
This CL contains a fix in the function and adds an embedder test for
this.

Bug=pdfium:745

Change-Id: I569f225598d956d270ef8f11ee3225acf48aadc7
Reviewed-on: https://pdfium-review.googlesource.com/6353
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Jane Liu <janeliulwq@google.com>
---
 fpdfsdk/fpdfeditpage.cpp | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

(limited to 'fpdfsdk/fpdfeditpage.cpp')

diff --git a/fpdfsdk/fpdfeditpage.cpp b/fpdfsdk/fpdfeditpage.cpp
index da156cd790..22b2261c6f 100644
--- a/fpdfsdk/fpdfeditpage.cpp
+++ b/fpdfsdk/fpdfeditpage.cpp
@@ -298,13 +298,15 @@ DLLEXPORT void STDCALL FPDFPage_TransformAnnots(FPDF_PAGE page,
     matrix.TransformRect(rect);
 
     CPDF_Array* pRectArray = pAnnot->GetAnnotDict()->GetArrayFor("Rect");
-    if (!pRectArray)
+    if (pRectArray)
+      pRectArray->RemoveAt(0, pRectArray->GetCount());
+    else
       pRectArray = pAnnot->GetAnnotDict()->SetNewFor<CPDF_Array>("Rect");
 
-    pRectArray->SetNewAt<CPDF_Number>(0, rect.left);
-    pRectArray->SetNewAt<CPDF_Number>(1, rect.bottom);
-    pRectArray->SetNewAt<CPDF_Number>(2, rect.right);
-    pRectArray->SetNewAt<CPDF_Number>(3, rect.top);
+    pRectArray->AddNew<CPDF_Number>(rect.left);
+    pRectArray->AddNew<CPDF_Number>(rect.bottom);
+    pRectArray->AddNew<CPDF_Number>(rect.right);
+    pRectArray->AddNew<CPDF_Number>(rect.top);
 
     // TODO(unknown): Transform AP's rectangle
   }
-- 
cgit v1.2.3